Encoding issue

Can lead to XSS